Rules that were never enforced

The delivery vehicle for the divergence purge (#3835), PR 1 of 6 · 2026-08-31

The measurement that started it

src/settings/ork.settings.json      ships 26 deny rules ("Bash(rm -rf /)", "Read(~/.ssh/**)", ...)
CC 2.1.226 and 2.1.251 (binary)     read from a plugin settings.json: pick(["agent","subagentStatusLine"])
                                    "permissions" is silently discarded
=> every rule ork ever shipped there was DEAD TEXT since v7.0.0.
   The 29 blocking hooks were the only live enforcement, and they are what users
   escaped with --dangerously-skip-permissions.

So the purge needs a vehicle first. Deleting the hooks while the JSON is inert removes real protection. This PR builds the delivery path; the deletions ride behind it.

What ships

piece	detail
payload	`skills/setup/references/operator-permissions.json`: 39 deny rules (the 26 that were dead, plus rm -fr twins, mv to /dev/null, .env Read/Edit/Write). The 3 SQL substrings are inexpressible as rules; loss accepted by operator decision.
writer	`skills/setup/scripts/write-operator-permissions.mjs`: consent-gated (dry-run first, explicit yes, then write), set-union into the OPERATOR's own settings.json, full backup, one-command rollback. Sandbox block is printed, never written.
audit	`skills/doctor/scripts/check-operator-permissions.sh`: which payload rules are enforced, from which scope, sandbox posture; exit 1 names the remedy, exit 2 is could-not-observe.
tripwire	`tests/ci/restricted-smoke/probe-permission-deny.sh` + a scripted tool_use in the stub API: canary file, two arms, zero spend, runs in CI after the restricted smoke lane.

The probe result the purge stands on

control arm  (no rule, --dangerously-skip-permissions):   canary EXISTS   the probe can see execution
trip arm     (permissions.deny, same bypass flag):        canary absent   and the model received the denial text

=> CC's native deny holds in exactly the mode the affected users run.
   If CC ever changes this, the CI step fails with REGRESSED and names the restore path.